基于TPCM的容器云可信环境研究

刘国杰; 张建标; 杨萍; 李铮

doi:10.11959/j.issn.2096-109x.2021068

您当前的位置：

首页 >

文章列表页 >

基于TPCM的容器云可信环境研究

学术论文 | 更新时间：2024-06-03

- 基于TPCM的容器云可信环境研究
- Research on the trusted environment of container cloud based on the TPCM
- 网络与信息安全学报 2021年7卷第4期页码：164-174
- 作者机构：
  
  1. 北京工业大学信息学部，北京 100124
  2. 可信计算北京市重点实验室，北京 100124
  3. 北京信息科技大学，北京 100192
- 作者简介：
  
  [ "刘国杰（1982− ），男，北京工业大学博士生，主要研究方向为网络与信息安全、可信计算" ]
  [ "张建标（1969− ），男，北京工业大学教授、博士生导师，主要研究方向为网络与信息安全、可信计算" ]
  [ "杨萍（1987− ），女，北京信息科技大学讲师，主要研究方向为人工智能、智能信息处理、机器学习和信息安全" ]
  [ "李铮（1992− ），女，北京工业大学讲师，主要研究方向为信息安全、密码分析和对称密码算法的设计" ]
- 基金信息：
  
  国家自然科学基金;The National Natural Science Foundation of China(61971014);国防科技实验信息安全实验室对外开放项目;National Defense Science and Technology Laboratory of Information Security(2017XXAQ08)
- DOI：10.11959/j.issn.2096-109x.2021068
  中图分类号： TP309
- 网络首发：2021-08，
  
  纸质出版：2021-08-15
- 稿件说明：
移动端阅览
刘国杰, 张建标, 杨萍, 等. 基于TPCM的容器云可信环境研究[J]. 网络与信息安全学报, 2021,7(4):164-174.

Guojie LIU, Jianbiao ZHANG, Ping YANG, et al. Research on the trusted environment of container cloud based on the TPCM[J]. Chinese Journal of Network and Information Security, 2021, 7(4): 164-174.
刘国杰, 张建标, 杨萍, 等. 基于TPCM的容器云可信环境研究[J]. 网络与信息安全学报, 2021,7(4):164-174. DOI： 10.11959/j.issn.2096-109x.2021068.

Guojie LIU, Jianbiao ZHANG, Ping YANG, et al. Research on the trusted environment of container cloud based on the TPCM[J]. Chinese Journal of Network and Information Security, 2021, 7(4): 164-174. DOI： 10.11959/j.issn.2096-109x.2021068.

摘要

容器技术是一种轻量级的操作系统虚拟化技术，被广泛应用于云计算环境，是云计算领域的研究热点，其安全性备受关注。提出了一种采用主动免疫可信计算进行容器云可信环境构建方法，其安全性符合网络安全等级保护标准要求。首先，通过 TPCM 对容器云服务器进行度量，由 TPCM 到容器的运行环境建立一条可信链。然后，通过在 TSB 增加容器可信的度量代理，实现对容器运行过程的可信度量与可信远程证明。最后，基于Docker与Kubernetes建立实验原型并进行实验。实验结果表明，所提方法能保障云服务器的启动过程与容器运行过程的可信，符合网络安全等级保护标准测评要求。

Abstract

Container technology is a lightweight operating system virtualization technology that is widely used in cloud computing environments and is a research hotspot in the field of cloud computing.The security of container technology has attracted much attention.A method for constructing a trusted environment of container cloud using active immune trusted computing was proposed

and its security meet the requirements of network security level protection standards.First

container cloud servers were measured through the TPCM and a trust chain from the TPCM to the container's operating environment was established.Then

by adding the trusted measurement agent of the container to the TSB

the trusted measurement and trusted remote attestation of the running process of the container were realized.Finally

an experimental prototype based on Docker and Kubernetes and conduct experiments were built.The experimental results show that the proposed method can ensure the credibility of the boot process of the cloud server and the running process of the container and meet the requirements of the network security level protection standard evaluation.

关键词

Keywords

references

张玉清 , 王晓菲 , 刘雪峰 , 等 . 云计算环境安全综述 [J ] . 软件学报 , 2016 , 27 ( 6 ): 1328 - 1348 .

ZHANG Y Q , WANG X F , LIU X F , et al . Survey on cloud computing security [J ] . Journal of Software , 2016 , 27 ( 6 ): 1328 - 1348 .

SINGH A , CHATTERJEE K . Cloud security issues and challenges:a survey [J ] . Journal of Network and Computer Applications , 2017 ,79.

SINGH S , JEONG Y S , PARK J H . A survey on cloud computing security:issues,threats,and solutions [J ] . Journal of Network and Computer Applications , 2016 ,75.

陈广勇 , 祝国邦 , 范春玲 . 《信息安全技术网络安全等级保护测评要求》（GB/T 28448-2019）标准解读 [J ] . 信息网络安全杂志 , 2019 , 19 ( 7 ): 1 - 8 .

CHEN G Y , ZHU G B , FAN C L . Information security technology-evaluation requirement for classified protection of cybersecurity (GB/T 28448-2019) standard interpretation [J ] . Netinfo Security , 2019 , 19 ( 7 ): 1 - 8 .

吴松 , 王坤 , 金海 . 操作系统虚拟化的研究现状与展望 [J ] . 计算机研究与发展 , 2019 , 56 ( 1 ): 58 - 68 .

WU S , WANG K , JIN H . Research situation and prospects of operating system virtualization [J ] . Journal of Computer Research and Development , 2019 , 56 ( 1 ): 58 - 68 .

FELTER W , FERREIRA A , RAJAMONY R , et al . An updated performance comparison of virtual machines and Linux containers [C ] // 2015 IEEE International Symposium on Performance Analysis of Systems and Software (ISPASS) . 2015 .

MERKEL D . Docker:lightweight linux containers for consistent development and deployment [J ] . Linux Journal , 2014 ( 1 ): 76 - 90 .

BRENDAN B , BRIAN G , DAVID O , et al . Borg,Omega,and Kubernetes [J ] . Communications of the ACM , 2016 , 59 ( 5 ): 50 - 57 .

SULTAN S , AHMAD I , DIMITRIOU T . Container security:issues,challenges,and the road ahead [J ] . IEEE Access , 2019 , 7 ( 1 ): 52976 - 52996 .

RUI S , GU X H , ENCK W . A study of security vulnerabilities on docker hub [C ] // Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy . 2017 .

THANH B . Analysis of docker security [J ] . arXiv preprint arXiv:1501.02967 , 2015 .

鲁涛 , 陈杰 , 史军 . Docker 安全性研究 [J ] . 计算机技术与发展 , 2018 , 28 ( 6 ): 115 - 120 .

LU T , CHEN J , SHI J . Research of Docker security [J ] . Computer Technology and Development , 2018 , 28 ( 6 ): 115 - 120 .

JAYANTH G , DESIKAN T , TURNER Y . Over 30% of official images in docker hub contain high priority security vulnerabilities [R ] . Technical Report . 2015 .

MANU A R , PATEL J K , AKHTAR S , et al . A study,analysis and deep dive on cloud PAAS security in terms of Docker container security [C ] // 2016 International Conference on Circuit,Power and Computing Technologies (ICCPCT) . 2016 .

SUN Y Q , SAFFORD D , ZOHAR M , et al . Security namespace:making Linux security frameworks available to containers [C ] // Proceedings of the 27th USENIX Conference on Security Symposium (SEC'18) . 2018 : 1423 - 1439 .

BENEDICTIS M D , LIOY A . Integrity verification of Docker containers for a lightweight cloud environment [J ] . Future Generation Computer Systems , 2019 , 97 ( 8 ): 236 - 246 .

HOSSEINZADEH S , LAURÉN S ,, LEPPNEN V . Security in container-based virtualization through vTPM [C ] // IEEE/ACM International Conference on Utility ＆ Cloud Computing . 2017 .

GUO Y , YU A , GONG X , et al . Building trust in container environment [C ] // 2019 18th IEEE International Conference on Trust,Security and Privacy in Computing and Communications/13th IEEE International Conference on Big Data Science and Engineering (TrustCom/BigDataSE) . 2019 .

王鹃 , 胡威 , 张雨菡 , 等 . 基于Docker的可信容器 [J ] . 武汉大学学报(理学版) , 2017 , 63 ( 2 ): 102 - 108 .

WANG J , HU W , ZHANG Y H , et al . Trusted container based on Docker [J ] . Journal of Wuhan University (Natural Science Edition) , 2017 , 63 ( 2 ): 102 - 108 .

XIE X L , YUAN T W , ZHOU X , et al . Research on trust model in container-based cloud service [J ] . CMC:Computers,Materials ＆Continua , 2018 , 56 ( 2 ).

冯登国 , 秦宇 , 汪丹 , 等 . 可信计算技术研究 [J ] . 计算机研究与发展 , 2011 , 48 ( 8 ): 1332 - 1349 .

FENG D G , QIN Y , WANG D , et al . Research on trusted computing technology [J ] . Journal of Computer Research and Development , 2011 , 48 ( 8 ): 1332 - 1349 .

SHEN C X , ZHANG H G , WANG H M , et al . Research on trusted computing and its development [J ] . Science China Information Sciences , 2010 , 53 ( 3 ): 405 - 433 .

张焕国 , 罗捷 , 金刚 , 等 . 可信计算研究进展 [J ] . 武汉大学学报(理学版) , 2006 ( 5 ): 513 - 518 .

ZHANG H G , LUO J , JIN G , et al . Development of trusted computing research [J ] . Wuhan University Journal of Natural Sciences , 2006 ( 5 ): 513 - 518 .

FENG D G , QIN Y , FENG W , et al . The theory and practice in the evolution of trusted computing [J ] . Chinese Science Bulletin , 2014 , 59 ( 32 ): 4173 - 4189 .

郭颖 , 毛军捷 , 张翀斌 , 等 . 基于可信平台控制模块的主动度量方法 [J ] . 清华大学学报(自然科学版) , 2012 , 52 ( 10 ): 1465 - 1473 .

GUO Y , MAO J J , ZHANG C B , et al . Active measures base on a trusted platform control module [J ] . Journal of Tsinghua University (Sci and Tech) , 2012 , 52 ( 10 ): 1465 - 1473 .

中国国家标准化委员会 . 信息安全技术可信计算规范可信平台控制模块 [S ] . 征求意见稿 , 2019 .

National Information Security Standardization Technical Committee . Information security technology-trusted computing specification-motherboard function and interface of trusted platform [S ] . Draft for Comments , 2019 .

沈昌祥 . 用主动免疫可信计算 3.0 筑牢网络安全防线营造清朗的网络空间 [J ] . 信息安全研究 , 2018 , 4 ( 4 ): 282 - 302 .

SHEN C X . To create a positive cyberspace by safeguarding network security with active immune trusted computing 3.0 [J ] . Journal of Information Security Research , 2018 , 4 ( 14 ): 282 - 302 .

GB/T 37935-2019 . 信息安全技术可信计算规范可信软件基 [S ] . 2020 .

GB/T 37935-2019 . Information security technology-Trusted computing specification-Trust software base [S ] . 2020 .

沈昌祥 , 张大伟 , 刘吉强 , 等 . 可信3.0战略:可信计算的革命性演变 [J ] . 中国工程科学 , 2016 , 18 ( 6 ): 53 - 57 .

SHEN C X , ZHANG D W , LIU J Q , et al . The strategy of TC 3.0:a revolutionary evolution in trusted computing [J ] . Strategic Study of Chinese Academy of Engineering , 2016 , 18 ( 6 ): 53 - 57 .

田俊峰 , 常方舒 . 基于 TPM 联盟的可信云平台管理模型 [J ] . 通信学报 , 2016 , 37 ( 2 ): 1 - 10 .

TIAN J F , CHANG F S . Trusted cloud platform management model based on TPM alliance [J ] . Journal on Communications , 2016 , 37 ( 2 ): 1 - 10 .

刘国杰 , 张建标 . 基于 TPCM 的服务器可信 PXE 启动方法 [J ] . 网络与信息安全学报 , 2020 , 6 ( 6 ): 105 - 111 .

LIU G J , ZHANG J B . TPCM-based trusted PXE boot method for servers [J ] . Chinese Journal of Network and Information Security , 2020 , 6 ( 6 ): 105 - 111 .

BERGER S , CÁCERES R ,, GOLDMAN K A , et al . vTPM:virtualizing the trusted platform module [J ] . Usenix Security , 2006 , 15 : 305 - 320 .

田健生 , 詹静 . 基于 TPCM 的主动动态度量机制的研究与实现 [J ] . 信息网络安全 , 2016 , 16 ( 6 ): 22 - 27 .

TIAN J S , ZHAN J . Research and implementation of active dynamic measurement based on TPCM [J ] . Netinfo Security , 2016 , 16 ( 6 ): 22 - 27 .

黄坚会 , 石文昌 . 基于ATX主板的TPCM主动度量及电源控制设计 [J ] . 信息网络安全 , 2016 , 16 ( 11 ): 1 - 5 .

HUANG J H , SHI W C . The TPCM active measurement and power control design for ATX motherboard [J ] . Netinfo Security , 2016 , 16 ( 11 ): 1 - 5 .

黄坚会 , 沈昌祥 . TPCM主动防御可信服务器平台设计 [J ] . 郑州大学学报(理学版) , 2019 , 51 ( 3 ): 1 - 6 .

HUANG J H , SHEN C X . Trusted platform design of server with TPCM active defense [J ] . Journal of Zhengzhou University (Natural Science Edition) (2019) , 2019 , 51 ( 3 ): 1 - 6 .

IBM's software TPM 2 [EB ] .

EDK Ⅱ project [EB ] .

Docker [EB ] .

Kubernetes [EB ] .

浏览量

510

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

SGX在可信计算中的应用分析

基于TPCM的服务器可信PXE启动方法

面向第三方的云平台可信性在线评测及分析技术

基于加密SD卡的内网移动终端可信接入方案

智能电网PDA终端的密钥管理和认证研究